Commit Graph

263 Commits

Author SHA1 Message Date
Samuel Reed 351f001652 fix(security): avoid prototype pollution on model create and update (#1805) 2019-12-16 11:01:18 -05:00
Janny bc82f2e7a8
fix: model coerce (#1806) 2019-12-13 01:33:58 -05:00
Miroslav Bajtoš a647bb0736
Do not apply default values on data from database
Before this change, when a property was configured with a default value
at LoopBack side and the database was returned a record with a missing
value for such property, then we would supply use the configured
default.

This behavior is problematic for reasons explained in #1692.

In this commit, we are introducing a new model-level setting called
`applyDefaultsOnReads`, which is enabled by default for backwards
compatibility.

When this setting is set to `false`, operations like `find` and
`findOrCreate` will NOT apply default property values on data returned
by the database (connector).

Please note that most of the other CRUD methods did not apply default
values on database data as long as the connector provided native
implementation of the operation, that aspect is not changing.

Also note that default values are applied only on properties with
`undefined` values. The value `null` does not trigger application of
default values. This is important because SQL connectors return
`null` for properties with no value set.
2019-04-09 15:46:09 +02:00
Shing 88771f10fc Fix #1434 2.55.1 Throws when using where query against "JSON Object or ANY" Type (#1444)
* Test for JSON object or any type

* dao.js coercion type.definition existence check
2017-07-28 16:30:49 -04:00
loay 63f04a28d4 Catch errors using cb 2017-07-21 10:13:16 -04:00
nVitius 8ebccb65d1 Recursively coerce nested properties in dao 2017-07-11 12:55:01 -07:00
Ryan Graham e9baea77e0
fix missing findOrCreate error callback
Closes #1226
Resolves #1223

Signed-off-by: Ryan Graham <r.m.graham@gmail.com>
2017-03-16 18:32:47 -07:00
Heath Morrison c62ba21307 Coerce array-like objects into arrays
The query-string parser used by express
https://github.com/ljharb/qs#parsing-arrays
limits the size of arrays that are created from query strings to 20
items. Arrays larger than that are converted to objects using numeric
indices.

This commit fixes the coercion algorithm used by queries to
treat number-indexed objects as arrays. We still maintain a strict
understanding of an "array-like object" to limit the opportunity for
subtle bugs. In particular, the presence of non-index keys is an
indication that the object was not intended to be interpreted as
an array.
2017-01-10 15:11:20 +01:00
Heath Morrison 552dfc8f24 Continue _coerce after logical operators 2016-10-26 10:14:43 -04:00
Amir Jafarian e038b28e8c Fix manually 2016-10-19 17:35:26 -04:00
Amir Jafarian a1683fca59 Auto-update by eslint --fix 2016-10-19 17:04:05 -04:00
Amirali Jafarian 8caf4c8327 Merge pull request #1108 from strongloop/fix_geo_2.x
Fix the bug when near filter is used
2016-10-13 10:39:15 -04:00
Simon Ho a9d381605e Add ilike and nilike operators (#1136)
Closes #633

Backport of #1091
2016-10-12 19:19:31 -07:00
Amir Jafarian fde4c0bfd6 Fix bug when near filter is used 2016-10-11 17:08:42 -04:00
Amir Jafarian 8208e8ab63 Fix JSdoc 2016-10-11 12:21:36 -04:00
Amir Jafarian e103b50b63 Add 'isNewInstance' for updateAttributes
* Add 'isNewInstance' to loaded hook for updateAttes
2016-09-23 14:09:44 -04:00
Sonali Samantaray 44e1d29879 upsertWithWhere feature support in juggler DAO
Backport from #1001
2016-09-06 13:41:50 -04:00
Amir Jafarian a1a9bac9ba Implement `notify` for find method 2016-08-23 19:00:50 -04:00
Amir Jafarian 9da0e501da Backport globalization
Backport loopback-datasource-juggler#1022,
loopback-datasource-juggler#1024,
loopback-datasource-juggler#1026
2016-08-09 21:52:11 -04:00
Amir Jafarian 1b266bcf00 Return error if connector does not implement
* Return error if connector does not implement replaceById
* This patch is without globalization

Backport loopback-datasource-juggler#1034
2016-08-09 14:44:06 -04:00
Miroslav Bajtoš ebcb5a0546 Ensure stable order of items in DAO.find()
When post-processing result of find operation, use "async.map"
instead of "async.each + array.push" to ensure the order of items
is preserved.
2016-07-13 15:25:34 +02:00
Raymond Feng 6736d72b98 Merge pull request #986 from robinbiondi/postgresConcurency
Fix #984 Give request options(ex: transactions) to validators
2016-06-24 14:42:50 -07:00
RobinBiondi 35f14c38dc give options to validators #984 2016-06-24 22:04:35 +02:00
Amir Jafarian 26718c733a Give warning if PK is changed in hooks
* Give warning if PK is changed in `before save` and `loaded`
 operation hooks for replaceById
2016-06-08 15:54:22 -04:00
Amir Jafarian dddf0ee09a Retun err for UPSERT if the connector returns err 2016-06-02 08:31:13 -04:00
Amir Jafarian c093648525 Fix error message
* Fix error message when PK is changed in `replaceById`
2016-06-01 16:26:41 -04:00
Amir Jafarian 0d5cff5a0a Fix incompatibility between different connectors PR#938
* Fix incompatibility for replace methods between different connectors.
2016-05-28 09:12:30 -04:00
Simon Ho 65d6d6a508 Backport ESLint from master 2016-05-20 17:35:23 +02:00
Miroslav Bajtoš 289eac7565 eslint config 2.0 + remove extra empty lines
Upgrade eslint-config-loopback to ^2.0.0.

Remove extra empty lines to make `npm run lint` pass again.

[back-port of #909]
2016-04-19 17:06:04 +02:00
Miroslav Bajtoš a5187765f6 Run `eslint --fix` with config from master 2016-04-18 16:00:04 +02:00
Amir Jafarian 1eeacd0255 Fix `forceId` check for `replaceByIds` PR#896 2016-04-14 17:59:30 -04:00
Amir Jafarian 7773963b62 Define `patch` aliases
*Define `patchOrCreate` as an alias for `updateOrCreate`
*Define `PatchAttributes` as an alias for `updateAttributes`
2016-04-12 16:32:17 -04:00
Miroslav Bajtoš 093a69328c Insert copyright headers 2016-04-06 16:51:49 +02:00
Amir Jafarian ca766f1437 Implementtaion of replace
This includes:
*implementation of replaceAttributes
*implementtaion of replaceOrCreate
2016-02-04 16:05:11 -05:00
Amir Jafarian dbdf915334 Fix conversion for `updateAttributes` 2016-02-03 12:44:58 -05:00
Amir Jafarian 8ca67c3d48 Refactor `updateAttributes` 2016-01-25 11:15:18 -05:00
Miroslav Bajtoš 5fdd521985 Enhance "persisted" hook in DAO.updateAttributes
Add `isNewInstance:false` to the context reported by
DAO.updateAttributes()
2016-01-25 11:13:34 -05:00
Amir Jafarian 2423db1571 Fix a bug when validation is off for findOrCreate 2016-01-20 11:51:47 -08:00
Miroslav Bajtoš 80c3bd9d41 Merge pull request #752 from ernie58/optionalValidation
make automatic validation optional
2015-12-04 17:03:28 +01:00
Bert Casier 0f3f27af51 Make automatic validation optional
Make automatic validation optional on all CRUD methods in a loopback
model. This can be done in 2 ways

- set `automaticValidation` in the model settings

- set `validate` on the options passed when calling the crud methods

The options take precedence on the model setting.
By default the automatic validation remains true to be backwards
compatible
2015-12-03 16:34:25 +01:00
Abe BW 0334766490 fixed a bug where an error was sent to the updateAttributesCallback and then ignored 2015-11-23 14:07:35 -05:00
Clark Wang b1b36ed44e fix typo 2015-11-04 14:58:28 +08:00
Clark Wang b993fb9466 fix global leak that mocha complains
Signed-off-by: Clark Wang <clark.wangs@gmail.com>
2015-11-04 14:19:47 +08:00
Raymond Feng d0072b68a1 Merge pull request #739 from mdartic/master
Fix filtering relations of a model with an order specified
2015-10-28 08:38:03 -07:00
Federico Rampazzo 2de499ccb0 Added missing callback when a model is not found 2015-10-28 09:15:32 +00:00
mdartic 7c22db6ea7 Filtering relations of a model with an order specified 2015-10-16 18:21:04 +02:00
Ryan Schumacher 94c3f9a432 Ability to define normalization of undefined query
Add datasource and model setting `normalizeUndefinedInQuery`
to determine how it will handle undefined values. Options:

- nullify : converts undefined to null
- throw : throw an error on undefined value
- ignore : strip the key where undefined value is found

The default operation is to strip the key.
2015-10-07 09:26:09 -07:00
James Cooke 6dac956cf8 findByIds would fail when an array of 0 length was passed as its first argument 2015-09-23 16:27:41 +01:00
Simon Ho 57a9c40e16 Fix primary key checks 2015-08-27 13:59:43 -07:00
Simon Ho cd71a37bfa Relax id requirement for basic query operations 2015-08-20 02:57:53 -07:00